# Automated AI exploits target critical PHP vulnerabilities across global web servers

While the PHP2Shell bugs were uncovered using frontier models, automated attack scripts compressed disclosure response times to minutes.

- Canonical: https://reviewblip.com/news/automated-ai-exploits-target-critical-php-vulnerabilities-across-global-web-servers/
- Published: 2026-10-26T09:30:58.840Z
- Updated: 2026-10-26T09:30:58.840Z
- Author: ReviewBlip
- Category: Cybersecurity & Web Infrastructure
- Type: News

![Abstract cyber threat visualization illustrating code vulnerabilities and automated script exploitation](https://reviewblip.com/editorial-images/4d81ca40db81a365bfd45cc3798a93152676eed396d0819df6832ff0c33ca330)

Image credit: WIRED / Getty Images

Global internet infrastructure faced millions of automated exploit attempts within hours of the public disclosure of critical vulnerabilities in PHP, the server-side scripting language underlying more than 75% of public websites. The rapid assault illustrates how generative AI has radically compressed the window between vulnerability disclosure and active weaponization.

Dubbed 'PHP2Shell,' the vulnerabilities stem from memory handling routines in core PHP libraries that remained dormant for over a decade. While human security auditors had previously considered the edge cases too complex to weaponize reliably, researchers at security firm Calif developed practical exploit chains using frontier AI reasoning models as part of OpenAI's Patch the Planet program. Similar execution paths were independently confirmed by automated research agents at Wiz and OpenAI.

Telemetry from Cloudflare and Amazon Web Services indicated that malicious actors utilized AI-assisted coding tools to generate and iterate weaponized payload variations within hours of advisory publication. While emergency patches released by the PHP Foundation prevented widespread server takeovers on patched deployments, security teams reported unprecedented scanning volume targeting unpatched legacy endpoints.

Cybersecurity researchers emphasize that foundational open-source codebases with decades of legacy code represent prime targets for automated AI discovery. With both defensive researchers and criminal groups employing frontier models, system administrators face a drastically shortened remediation window where security updates must be applied within minutes to prevent compromise.

## Sources
- [\[src-wired-php-ai-exploits\] The PHP Meltdown Shows How AI Makes Bugs More Exploitable](https://www.wired.com/story/kernel-panic-the-php-meltdown-shows-how-ai-makes-bugs-more-exploitable/)